#!/bin/bash

# 设置变量
STUNNEL="stunnel-5.71"
CONNECT="3128"  # 要连接的stuunel服务器或squid的地址和端口
ACCEPT="3129"  # 代理监听的端口

# 以下如无特殊要求，无需修改
CONF_ROOT="/etc/stunnel"
CONF=$CONF_ROOT"/stunnel.conf"
CERT=$CONF_ROOT"/stunnel-server.pem"
CKEY=$CONF_ROOT"/stunnel-server.key"
CHROOT="/var/run/stunnel"
uid="stunnel"
gid='stunnel'

cd /opt
echo "Installing Stunnel Dependencies..."
# Ubuntu 请运行
apt-get install libssl-dev gcc make squid -y
# CentOS 请运行
# yum install libssl-dev gcc make squid -y

echo "Downloading Stunnel..."
curl -o $STUNNEL.tar.gz https://www.stunnel.org/archive/5.x/$STUNNEL.tar.gz
echo "Tarring Stunnel..."
tar -zxf $STUNNEL.tar.gz
echo "Configuring Stunnel..."
cd $STUNNEL
if ! { ./configure --sysconfdir=/etc --disable-dependency-tracking && make && make install; }; then
    echo "Failed to install stunnel"
    exit 1
fi

# 由于CentOS7.9版本编绎环境比较复杂，可以选择直接使用i32n的编译包
# cd /opt
# echo "Downloading Stunnel..."
# # curl -o stunnel-5.71-x86_64-linux.tar.gz https://www.i32n.com/downloads/stunnel-5.71-x86_64-linux.tar.gz
# echo "Tarring Stunnel..."
# # tar -zxf stunnel-5.71-x86_64-linux.tar.gz 
# echo "Lnking Stunnel..."
# ln -sf /opt/stunnel-5.71-x86_64-linux/usr/bin/stunnel /usr/local/bin/stunnel

echo "Creating Stunnel user..."
useradd -r -s /bin/false stunnel

echo "Creating Stunnel directory..."
mkdir $CONF_ROOT
touch $CONF_ROOT
mkdir $CHROOT
touch $CHROOT
chown $uid:$gid $CONF_ROOT
chown $uid:$gid $CHROOT

echo "Creating Stunnel configuration..."
sudo tee $CONF > /dev/null <<EOL
#stunnel工作目录
chroot = $CHROOT
; stunnel工作的用户组
setuid = $uid
setgid = $gid
; stunnel工作时候的pid
pid = /stunnel.pid
; 日志等级
debug = 7
; 日志文件
output = /stunnel.log
; 表示以client模式启动stunnel，默认client = no，即server模式
;client = yes
; 定义一个服务
[squid-proxy]
; 监听3128端口，那么用户浏览器的代理设置就是 stunnel-client-ip:3128
accept = $ACCEPT
; 要连接到的stunnel server的ip与端口
connect = $CONNECT
; 需要验证对方发过来的证书
verify = 2
; 用来进行证书验证的文件（里面有stunnel server的证书）
CAfile = $CERT
; 客户端不需要传递自己的证书，所以注释掉
cert = $CERT
key = $CKEY
EOL

echo "Creating Stunnel Cert..."
sudo tee $CERT > /dev/null <<EOL
-----BEGIN CERTIFICATE-----
MIID0TCCArmgAwIBAgIUcu+BNjnHu/A6G2zr7EYgaIA463swDQYJKoZIhvcNAQEL
BQAweDELMAkGA1UEBhMCY24xCzAJBgNVBAgMAmdkMQswCQYDVQQHDAJzejENMAsG
A1UECgwENTJ2MTELMAkGA1UECwwCY24xFjAUBgNVBAMMDXByb3h5LjUydjEuY24x
GzAZBgkqhkiG9w0BCQEWDDUydjFAMTYzLmNvbTAeFw0yNDEyMzEwMzQzMTdaFw0z
NDEyMjkwMzQzMTdaMHgxCzAJBgNVBAYTAmNuMQswCQYDVQQIDAJnZDELMAkGA1UE
BwwCc3oxDTALBgNVBAoMBDUydjExCzAJBgNVBAsMAmNuMRYwFAYDVQQDDA1wcm94
eS41MnYxLmNuMRswGQYJKoZIhvcNAQkBFgw1MnYxQDE2My5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/y4CCzHUrX4dx7STcUCNR2ph5flAHJHFb
Bfec4nYdGbTiYMRGL9f2MEo2aijTSlQp0bYsoSwUhekQd/Cr1+ugJiB+TwVV03Xf
hjZAm5jcaBxbxYGzub7S5k9BczZEsXyMYw//1ZI+tN5VZOUUYezeqLcW+U2QuhJk
5ur144qHXZufVR3KGH+zA/l8+16nJ81os90dXmucoEQZRq9kYkE/B1VlOdxFcCXV
6h1zdRA1ZKX+lGPcu+6H35Dhwqneam7oKNUuAqMzVBdl9jO2wBemwkKcHKl4soMx
Dn7IFRpcdIR4IxTUPHLXn73+XPZu/GFWCyFWd84c/bjEfCpK4a7bAgMBAAGjUzBR
MB0GA1UdDgQWBBRiGu7wDBkSWGKPDnvCacuUJpd+8DAfBgNVHSMEGDAWgBRiGu7w
DBkSWGKPDnvCacuUJpd+8DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUA
A4IBAQBo9NPSw2nSk9ddojCZ0CeHrncy7pVFNL74SO/jE4vkUkx19zERfL0dYZ1b
RaaCy9TA3MyrHlPqLLfr+RNCoQMtU+fOlkawAesCCHvex/HQhBjc6/i9syewTR20
sajOSC86iJklXZkJXNFxFZrRgL3iM2lFrWUGHKNNBl1YirprVWI3KTCzsIlL0idd
pM8MhqE24tS2ZqbSL4qjTa6fmnh4tsrQklEZpBzCfLWtCJGFyBcKw8XG1bKyxht7
kFhpA/la25VKWWvU1zzCpZBtWI2WTrh4gPn4BTIwRMcpmBMZWQpv8GYVrVo+g8np
iVf5VhRwehq7UZva74jX5dNN2/iQ
-----END CERTIFICATE-----
EOL

sudo tee $CKEY > /dev/null <<EOL
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC/y4CCzHUrX4dx
7STcUCNR2ph5flAHJHFbBfec4nYdGbTiYMRGL9f2MEo2aijTSlQp0bYsoSwUhekQ
d/Cr1+ugJiB+TwVV03XfhjZAm5jcaBxbxYGzub7S5k9BczZEsXyMYw//1ZI+tN5V
ZOUUYezeqLcW+U2QuhJk5ur144qHXZufVR3KGH+zA/l8+16nJ81os90dXmucoEQZ
Rq9kYkE/B1VlOdxFcCXV6h1zdRA1ZKX+lGPcu+6H35Dhwqneam7oKNUuAqMzVBdl
9jO2wBemwkKcHKl4soMxDn7IFRpcdIR4IxTUPHLXn73+XPZu/GFWCyFWd84c/bjE
fCpK4a7bAgMBAAECggEAPgdnZyYP6Piq2f4r0zL50VHEyVpAMKcpIBqkc/FL6Op0
9Vf9coOrsVv5zHJ2BKu/34yLAhEYLAUJFQHtbO5WrsNV8/PDknfi4elKp4eLHxFu
xoFwirtSi2vgCxdjYEEUumSZepDMjQo689w/OGHZVUO0fzIe02VSaJ7EM8Uk+tUM
XWBr86jXgr5AN+WrRkrlOWUk0ac37I8d+erFMA5pFXr/wN4xcUX9oU1zrSV1n6ni
P8Z/KNH4n456EByeOZ0D3SEj24bpXxyQVNnnJD7UorOPNhFbSaLhuuu6zFoi+WCL
VQmma8f25hGE7xrB97xPOsMG/MLZ2lcMhJsdGp9lDQKBgQDqmF4sB/96I0su0+pN
uTocV6u+8RIcl5k7iT9jpyomQ8H+UR9ry93JUdcmYFooYxSqOit0KYPrXlecI9g1
fOP9Sxf2X59PugvmJE8YvhruZEFQ2r95fLwgEHs4V52yaM1k2yTPMM3lgnByzLtV
PEcJDJztegHsJiQaF34eX07IPQKBgQDRS2nWuHS3Uy1yo9N/C5onWvT4ukAzEuFn
ZiB3GGg6h9ommt1Wv8OXtn4rh0IHckYazMC7e58860eYxchRaYk6Yo3Ghv9dCg5g
I2y1SNTiB3hNt0i5E3hllNtomFMhvGbRR7j4AGp931o4EqYdpOo5Ef7Hmi2cxFKj
LdI2fIQs9wKBgFZ6qqRyolQE9K8jgYj7UhemnfI6beHKZLtUweBbfCc07Stx/jI/
qdeP6s8Dz9h5heGmpeQhdbbrRUKS2B4HlwgFiaTR5Sl/vOku01WcptLgdE95BAKl
37e2O6YubjyZc7XNLwmNxSjo58j5/cjS+qC0XJkSU+kYulA//sb1fVZFAoGBAINK
46InJFC8hQ4dZ1eTV6jIjlRZwlxHw86xajxLu1a8UkVVcPQyZ+iMOqnjt7AkJ4Y4
W89AxavZjJhxujAYHFXb7URU+2zKGiqFDnTKs4D3XqiiCaTQaf6PWvRKWhwXrAgt
DgPFfwhnTJlQWZTPF3+lokZkmah2H8DtxakYg3IRAoGBANLwuwEUXk/70971qMv3
FNOIj6CuLp+Rjp2ddSkjIN7BDHOntWLfSLqXmW7azT49pORt2+jvPkf49Teh5irD
GnPTmEIT1D9PmFqL03fkH792z8+U7nGlJr7Fn5ECKotsVv7OL+fyw2kv4KB3r1lD
hKOBXK8UXwxSlq/Ew53FxQuV
-----END PRIVATE KEY-----
EOL

# 获自行生成证书，并将证书和私钥放到/etc/stunnel/目录下
# echo "Creating Stunnel Key..."
# sudo openssl genrsa -out $CERT.key 2048
# sudo openssl req -new -key $CERT.key -out $CERT.csr
# sudo openssl x509 -req -days 365 -in $CERT.csr -signkey $CERT.key -out $CERT
# sudo chmod 600 $CERT.key

echo "run start: stunnel"

echo "run test: curl -x http://127.0.0.1:3129 https://www.google.com"